Skip to content

Commit 830c1f8

Browse files
lylezhu2012kartben
lylezhu2012
authored and
kartben
committed
Bluetooth: AVDTP: Check buffer length before pulling it
Check the remaining data length of net buffer before pulling data from it. Fixes #83024 Signed-off-by: Lyle Zhu <[email protected]>
1 parent dbc6a50 commit 830c1f8

File tree

1 file changed

+81
-3
lines changed
  • subsys/bluetooth/host/classic

1 file changed

+81
-3
lines changed

‎subsys/bluetooth/host/classic/avdtp.c‎

Lines changed: 81 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,11 @@ static void avdtp_discover_handler(struct bt_avdtp *session,
231231
DISCOVER_REQ(session->req)->status = 0;
232232
DISCOVER_REQ(session->req)->buf = buf;
233233
} else if (msg_type == BT_AVDTP_REJECT) {
234+
if (buf->len < 1) {
235+
LOG_WRN("Invalid RSP frame");
236+
return;
237+
}
238+
234239
DISCOVER_REQ(session->req)->status = net_buf_pull_u8(buf);
235240
} else if (msg_type == BT_AVDTP_GEN_REJECT) {
236241
DISCOVER_REQ(session->req)->status = BT_AVDTP_NOT_SUPPORTED_COMMAND;
@@ -266,6 +271,11 @@ static void avdtp_get_capabilities_handler(struct bt_avdtp *session,
266271
struct bt_avdtp_sep *sep;
267272
uint8_t error_code = 0;
268273

274+
if (buf->len < 1) {
275+
LOG_WRN("Invalid ACP SEID");
276+
return;
277+
}
278+
269279
sep = avdtp_get_sep(net_buf_pull_u8(buf) >> 2);
270280
if ((sep == NULL) || (session->ops->get_capabilities_ind == NULL)) {
271281
err = -ENOTSUP;
@@ -320,6 +330,11 @@ static void avdtp_get_capabilities_handler(struct bt_avdtp *session,
320330
GET_CAP_REQ(session->req)->buf = buf;
321331
}
322332
} else if (msg_type == BT_AVDTP_REJECT) {
333+
if (buf->len < 1) {
334+
LOG_WRN("Invalid RSP frame");
335+
return;
336+
}
337+
323338
GET_CAP_REQ(session->req)->status = net_buf_pull_u8(buf);
324339
} else if (msg_type == BT_AVDTP_GEN_REJECT) {
325340
GET_CAP_REQ(session->req)->status = BT_AVDTP_NOT_SUPPORTED_COMMAND;
@@ -342,6 +357,11 @@ static void avdtp_process_configuration(struct bt_avdtp *session,
342357
struct net_buf *rsp_buf;
343358
uint8_t error_code = 0;
344359

360+
if (buf->len < 1) {
361+
LOG_WRN("Invalid ACP SEID");
362+
return;
363+
}
364+
345365
sep = avdtp_get_sep(net_buf_pull_u8(buf) >> 2);
346366
if ((sep == NULL) || (session->ops->set_configuration_ind == NULL)) {
347367
err = -ENOTSUP;
@@ -352,6 +372,11 @@ static void avdtp_process_configuration(struct bt_avdtp *session,
352372
} else {
353373
uint8_t int_seid;
354374

375+
if (buf->len < 1) {
376+
LOG_WRN("Invalid INT SEID");
377+
return;
378+
}
379+
355380
/* INT Stream Endpoint ID */
356381
int_seid = net_buf_pull_u8(buf);
357382
err = session->ops->set_configuration_ind(session,
@@ -399,6 +424,11 @@ static void avdtp_process_configuration(struct bt_avdtp *session,
399424
SET_CONF_REQ(req)->status = 0;
400425
SET_CONF_REQ(req)->sep->state = AVDTP_CONFIGURED;
401426
} else if (msg_type == BT_AVDTP_REJECT) {
427+
if (buf->len < 2) {
428+
LOG_WRN("Invalid RSP frame");
429+
return;
430+
}
431+
402432
/* Service Category */
403433
net_buf_pull_u8(buf);
404434
SET_CONF_REQ(req)->status = net_buf_pull_u8(buf);
@@ -458,6 +488,11 @@ static void avdtp_open_handler(struct bt_avdtp *session,
458488
struct net_buf *rsp_buf;
459489
uint8_t error_code = 0;
460490

491+
if (buf->len < 1) {
492+
LOG_WRN("Invalid ACP SEID");
493+
return;
494+
}
495+
461496
sep = avdtp_get_sep(net_buf_pull_u8(buf) >> 2);
462497
if ((sep == NULL) || (session->ops->open_ind == NULL)) {
463498
err = -ENOTSUP;
@@ -510,6 +545,11 @@ static void avdtp_open_handler(struct bt_avdtp *session,
510545
return;
511546
}
512547
} else if (msg_type == BT_AVDTP_REJECT) {
548+
if (buf->len < 1) {
549+
LOG_WRN("Invalid RSP frame");
550+
return;
551+
}
552+
513553
OPEN_REQ(req)->status = net_buf_pull_u8(buf);
514554
} else if (msg_type == BT_AVDTP_GEN_REJECT) {
515555
OPEN_REQ(req)->status = BT_AVDTP_NOT_SUPPORTED_COMMAND;
@@ -535,6 +575,11 @@ static void avdtp_start_handler(struct bt_avdtp *session,
535575
struct net_buf *rsp_buf;
536576
uint8_t error_code = 0;
537577

578+
if (buf->len < 1) {
579+
LOG_WRN("Invalid ACP SEID");
580+
return;
581+
}
582+
538583
sep = avdtp_get_sep(net_buf_pull_u8(buf) >> 2);
539584
if ((sep == NULL) || (session->ops->start_ind == NULL)) {
540585
err = -ENOTSUP;
@@ -584,6 +629,11 @@ static void avdtp_start_handler(struct bt_avdtp *session,
584629
} else if (msg_type == BT_AVDTP_REJECT) {
585630
uint8_t acp_seid;
586631

632+
if (buf->len < 2) {
633+
LOG_WRN("Invalid RSP frame");
634+
return;
635+
}
636+
587637
acp_seid = net_buf_pull_u8(buf);
588638
if (acp_seid != START_REQ(req)->acp_stream_ep_id) {
589639
return;
@@ -611,6 +661,11 @@ static void avdtp_close_handler(struct bt_avdtp *session,
611661
struct net_buf *rsp_buf;
612662
uint8_t error_code = 0;
613663

664+
if (buf->len < 1) {
665+
LOG_WRN("Invalid ACP SEID");
666+
return;
667+
}
668+
614669
sep = avdtp_get_sep(net_buf_pull_u8(buf) >> 2);
615670
if ((sep == NULL) || (session->ops->close_ind == NULL)) {
616671
err = -ENOTSUP;
@@ -660,6 +715,11 @@ static void avdtp_suspend_handler(struct bt_avdtp *session,
660715
struct net_buf *rsp_buf;
661716
uint8_t error_code = 0;
662717

718+
if (buf->len < 1) {
719+
LOG_WRN("Invalid ACP SEID");
720+
return;
721+
}
722+
663723
sep = avdtp_get_sep(net_buf_pull_u8(buf) >> 2);
664724
if ((sep == NULL) || (session->ops->suspend_ind == NULL)) {
665725
err = -ENOTSUP;
@@ -708,6 +768,11 @@ static void avdtp_abort_handler(struct bt_avdtp *session,
708768
struct net_buf *rsp_buf;
709769
uint8_t error_code = 0;
710770

771+
if (buf->len < 1) {
772+
LOG_WRN("Invalid ACP SEID");
773+
return;
774+
}
775+
711776
sep = avdtp_get_sep(net_buf_pull_u8(buf) >> 2);
712777
if ((sep == NULL) || (session->ops->abort_ind == NULL)) {
713778
err = -ENOTSUP;
@@ -1201,19 +1266,32 @@ int bt_avdtp_parse_capability_codec(struct net_buf *buf,
12011266
case BT_AVDTP_SERVICE_HEADER_COMPRESSION:
12021267
case BT_AVDTP_SERVICE_MULTIPLEXING:
12031268
case BT_AVDTP_SERVICE_DELAY_REPORTING:
1269+
if (buf->len < 1) {
1270+
return -EINVAL;
1271+
}
1272+
12041273
length = net_buf_pull_u8(buf);
1274+
if (buf->len < length) {
1275+
return -EINVAL;
1276+
}
1277+
12051278
if (length > 0) {
12061279
net_buf_pull_mem(buf, length);
12071280
}
12081281
break;
12091282

12101283
case BT_AVDTP_SERVICE_MEDIA_CODEC:
1284+
if (buf->len < 1) {
1285+
return -EINVAL;
1286+
}
1287+
12111288
length = net_buf_pull_u8(buf);
1289+
if (buf->len < length) {
1290+
return -EINVAL;
1291+
}
1292+
12121293
if (length > 3) {
12131294
data = net_buf_pull_u8(buf);
1214-
if (net_buf_tailroom(buf) < (length - 1)) {
1215-
return -EINVAL;
1216-
}
12171295
if (data == BT_AVDTP_AUDIO) {
12181296
data = net_buf_pull_u8(buf);
12191297
*codec_type = data;

0 commit comments

Comments
 (0)